A Cyber Framework Fit for Global Use: Cybersecurity Framework (CSF) 2.0

Venable LLP

18 Sept 202386:51

EducationalLearning

32 Likes 10 Comments

TLDRThe discussion, co-hosted by the Coalition to Reduce Cyber Risk and NIST, revolved around the Cyber Security Framework 2.0, emphasizing its global utility and updates. International stakeholders shared insights on integrating the framework for effective risk management. The session highlighted the importance of adapting the framework to various sectors, aligning with international standards, and the new governance function in CSF 2.0. It underscored the framework's role in fostering a common language for cyber risk discussions and the need for public input to refine the tool.

Takeaways

📅 The event discussed the recently released draft of the Cybersecurity Framework (CSF) 2.0, which is a critical tool for organizations managing risk globally.
🌟 The CSF has been acknowledged as a valuable risk management tool by international governments and industries, and has been adapted and translated into multiple languages.
🔍 The update to CSF 2.0 aims to ensure its continued relevance and effectiveness in the evolving cybersecurity landscape, with a focus on international input to make it fit for purpose globally.
🗓️ There is an open consultation for the CSF 2.0, and an upcoming workshop on the 19th, encouraging active participation to shape the framework.
🛡️ The CSF is rooted in international standards and provides a common language for organizations of varying sizes and cybersecurity expertise to manage risks.
🔄 Version 1.1 of the CSF has already incorporated feedback, including an increased focus on supply chain risk management and vulnerability disclosure.
🌐 The international uptake of the CSF has been significant, with adaptations and translations aiding its use in various countries and sectors.
🔑 The addition of a 'Governance' function in CSF 2.0 is seen as a positive development, providing a framework for overall risk management strategy and processes within organizations.
🔄 The framework is designed to be flexible and adaptable, with updates reflecting changes in technology and the risk management landscape.
🤝 There is an emphasis on collaboration and public-private partnerships in developing and refining the CSF, to ensure its utility and effectiveness.

Q & A

What is the main focus of the discussion in the provided transcript?
-The main focus of the discussion is the Cyber Security Framework (CSF) 2.0, its global application, and the recent draft release. The conversation also includes international perspectives on its use and the importance of input from various stakeholders to ensure its effectiveness beyond the U.S. context.
Who is Alex Botting and what is his role in the discussion?
-Alex Botting is the Service Coordinator for the Coalition to Reduce Cyber Risk (CR2). He is moderating the discussion and providing insights on the collaboration with NIST and the importance of the CSF for managing cyber risk globally.
What is the significance of the CSF for organizations?
-The CSF is a critical tool for organizations to manage risk globally, providing a framework that helps in identifying, protecting, detecting, responding to, and recovering from cyber events. It is used across borders and is applicable to various sectors.
What does the acronym 'CR2' stand for and what is its purpose?
-CR2 stands for the Coalition to Reduce Cyber Risk. It is a collaborative effort aimed at reducing cyber risk by promoting the use of effective tools like the Cyber Security Framework and engaging in consultations with international stakeholders.
What is the role of NIST in the development of the CSF?
-The National Institute of Standards and Technology (NIST) is responsible for developing and updating the CSF in collaboration with various stakeholders. They have been instrumental in creating a public-private partnership to produce an effective tool for cyber security risk management.
What is the significance of the CSF 2.0 update?
-The CSF 2.0 update is significant as it aims to ensure that the framework remains fit for purpose in both the U.S. and international contexts. It incorporates feedback from stakeholders and reflects changes in the cyber security risk management landscape and technology.
What is the importance of international engagement in the development of the CSF 2.0?
-International engagement is crucial for the development of CSF 2.0 to ensure that the framework is globally applicable and incorporates diverse perspectives. It helps in understanding how the framework can be adapted and used effectively in different countries and sectors.
What is the role of the NIST Applied Cyber Security Division in the CSF?
-The NIST Applied Cyber Security Division, led by Kevin Stein, plays a key role in hosting cyber security risk management series, engaging with stakeholders, and leading the process of updating the CSF to version 2.0.
What are the key changes proposed in the CSF 2.0 draft?
-Key changes proposed in the CSF 2.0 draft include a focus on supply chain risk management, alignment with international standards, incorporation of measurement and metrics, and the addition of a new governance function to provide a more holistic approach to cyber security risk management.
How can stakeholders provide feedback on the CSF 2.0 draft?
-Stakeholders can provide feedback on the CSF 2.0 draft through public comment, which is open until a specified date (e.g., November 4th, as mentioned in the transcript). They can also participate in workshops and discussions to share their perspectives and experiences.
What is the relationship between the CSF and the NIS Directive 2.0 in the EU?
-The NIS Directive 2.0 in the EU aims to ensure a higher baseline of security for critical infrastructure and maintain consistency across the EU. While the transcript does not directly address the relationship between the CSF and NIS Directive 2.0, it implies that international standards and frameworks like the CSF can be leveraged to help achieve these objectives and ensure a consistent approach across the member states.

Outlines

00:00

🗣️ Opening Remarks and Introduction to Cybersecurity Framework 2.0

The script begins with Alex Botting, Service Coordinator for the Coalition to Reduce Cyber Risk (CR2), welcoming participants to a discussion on the Cybersecurity Framework (CSF) 2.0. The event is co-hosted with NIST and aims to engage international stakeholders on the recently released draft of CSF 2.0. Alex emphasizes the importance of global input for the framework's update and introduces the next speaker, Kevin Stein, Chief of NIST's Applied Cybersecurity Division.

05:00

🌐 International Adoption and Progression of CSF 2.0

Kevin Stein appreciates the opportunity to discuss the CSF's evolution and its international adoption. He highlights the framework's growth since 2014 and the importance of stakeholder feedback in shaping the update to CSF 2.0. Kevin mentions the draft's public comment period and an upcoming workshop, encouraging active participation. He also discusses the international translations and adaptations of the CSF, noting its global utility.

10:02

📈 Updates on Cybersecurity Framework Development and International Engagement

Amy Mon, from NIST's Applied Cybersecurity Division, presents on the CSF's development, emphasizing the framework's role in managing cybersecurity risks since its inception in 2014. She discusses the framework's structure, its alignment with international standards, and updates in version 1.1. Amy also addresses the need for a 2.0 version to incorporate changes in technology and risk management, mentioning the request for information, workshops, and analyses conducted to gather feedback for the update.

15:03

🔍 Deep Dive into CSF 2.0's Draft and Public Feedback Mechanism

The script continues with a detailed look at the draft CSF 2.0, its public comment period, and the significant changes proposed based on public feedback. It mentions the addition of new implementation examples and the final workshop for gathering insights before the final release of CSF 2.0. The focus is on incorporating supply chain risk management, integrating with other NIST resources, and making the framework more accessible for small and medium-sized businesses.

20:04

🌟 Showcase of International Adaptations and Translations of CSF

The paragraph discusses the international adaptations and translations of the CSF, highlighting its global reach and the various ways it has been integrated into national policies and cybersecurity methodologies. It also mentions the addition of a Norwegian translation and the importance of localizing the framework to make it more accessible and understandable for a wider range of users.

25:07

🤝 International Perspectives on CSF's Utility and Updates

The script presents international perspectives from representatives of the Norwegian Agency for Public and Financial Management and the Czech National Cyber and Information Security Agency. They discuss their experiences with the CSF, its influence on security measures, and the importance of aligning it with international standards like ISO 27001. The discussion also touches on the challenges and benefits of using the CSF in procurement and the anticipation of CSF 2.0's updates.

30:08

🛡️ Industry Application of CSF and Anticipation for 2.0 Enhancements

Industry leaders from Schneider Electric and MasterCard share their companies' experiences with the CSF, detailing how it has been integrated into their cybersecurity strategies and operations. They discuss the framework's impact on risk management, the importance of storytelling in cybersecurity, and their expectations for CSF 2.0, including the potential for greater emphasis on governance and supply chain security.

35:11

🔗 Linking CSF with Privacy Framework and Managing Third-Party Risks

The script explores the connection between the CSF and the NIST Privacy Framework, discussing the complementary nature of the two in managing cybersecurity and privacy risks. It also addresses the challenge of dealing with third-party risks, comparing it to managing supply chain risks and emphasizing the need for a holistic approach that considers all aspects of the framework.

40:11

📘 Navigating the Complexity of 800-53 and the Utility of CSF as a Prioritization Tool

The final paragraph discusses the overwhelming nature of the 800-53 control catalog and positions the CSF as a valuable tool for prioritization and navigating complex cybersecurity standards. It acknowledges the continuous evolution of cybersecurity and the importance of the framework in guiding organizations towards developing effective cybersecurity programs.

45:13

🏁 Closing Remarks and Call to Action for Framework Improvements

In conclusion, the script thanks the speakers and participants for their contributions to the discussion on the CSF. It emphasizes the importance of the framework as a tool for managing cyber risk and encourages stakeholders to provide feedback on the CSF 2.0 draft. The goal is to ensure the framework remains a relevant and useful resource for organizations globally.

Mindmap

Keywords

💡Cyber Security Framework (CSF)

The Cyber Security Framework (CSF) is a policy tool developed by the National Institute of Standards and Technology (NIST) to help organizations manage and mitigate cyber risk. In the video, CSF is central to the discussion as international stakeholders are exploring its global application and the upcoming 2.0 update, which aims to ensure its continued relevance and effectiveness across borders.

💡NIST

NIST, the National Institute of Standards and Technology, is a U.S. federal agency that develops standards and guidelines for various fields, including cybersecurity. In the script, NIST is mentioned as the developer of the CSF and as the organization running the open consultation for the CSF 2.0 update.

💡Risk Management

Risk management refers to the process of identifying, assessing, and prioritizing risks to minimize or prevent negative impacts. In the video, risk management is a core concept, with the CSF serving as a tool for organizations to manage cybersecurity risks globally.

💡International Stakeholders

International stakeholders encompass governments, industries, and other organizations from around the world that have an interest in the global application of the CSF. The script discusses the importance of their involvement in the update of the CSF to ensure its international relevance.

💡Public-Private Partnership

A public-private partnership is a collaborative arrangement between government agencies and private-sector companies to finance and/or deliver services and systems. In the context of the video, the effective public-private partnership convened by NIST is praised for developing the CSF as a tool for cybersecurity risk management.

💡Supply Chain Risk Management

Supply chain risk management involves identifying, assessing, and mitigating risks in the supply chain to ensure the integrity and security of products and services. The script mentions the increased focus on supply chain risk management as an important aspect of the CSF 2.0 update.

💡Governance

Governance in the context of the CSF refers to the overarching risk management strategy and processes within an organization. The script discusses the new 'Govern' function being introduced in CSF 2.0, emphasizing its importance for overall risk management.

💡Stakeholder Engagement

Stakeholder engagement is the process of involving all parties with an interest or stake in a policy or initiative. In the video, stakeholder engagement is highlighted as crucial for the development and improvement of the CSF through feedback and participation in workshops and consultations.

💡Cybersecurity Risk

Cybersecurity risk is the potential for loss or damage that an organization may face as a result of cyber threats or vulnerabilities. The entire discussion in the script revolves around managing these risks through the use of the CSF.

💡International Standards

International standards are guidelines and specifications used across different countries and regions to ensure compatibility, efficiency, and safety. The script mentions the alignment of the CSF with international standards like ISO 27001, indicating the framework's global applicability.

💡Workshop

A workshop in this context refers to a structured event where stakeholders gather to discuss, collaborate, and provide input on specific topics. The script mentions an upcoming NIST workshop as an opportunity for stakeholders to engage with the CSF 2.0 update process.

Highlights

Introduction to the Cybersecurity Framework (CSF) 2.0 discussion, emphasizing its global applicability and the importance of international stakeholder input.

The CSF has been a critical tool for organizations in managing risk across borders, highlighting its significance in the global context.

Announcement of the release of the CSF 2.0 draft and an open call for public comments to ensure its relevance in various contexts, including non-US scenarios.

Discussion on the CSF's evolution, including its initial development and the collaborative efforts with stakeholders over the years.

The CSF's alignment with international standards such as ISO 27001, indicating its adaptability and universality in risk management.

Presentation of the CSF's five functions: Identify, Protect, Detect, Respond, and Recover, as a comprehensive approach to cybersecurity risk management.

The update from version 1.1 to 2.0, reflecting changes in the cybersecurity landscape and the importance of adapting the framework to current needs.

International uptake of the CSF, with over 10 translations and adaptations in various countries, showcasing its global impact.

The role of the CSF in national policies, such as in Japan's communication sector, and its influence on international cybersecurity strategies.

The upcoming NIST workshop on CSF 2.0, encouraging active participation for further refinement of the framework.

The significance of public-private partnerships in developing effective cybersecurity tools, as exemplified by the CSF.

Amy Mon's presentation on the updates to CSF 2.0, including the process and engagement with international stakeholders.

The focus on supply chain risk management in the updated CSF, reflecting the growing concern over vulnerabilities in the supply chain.

Inclusion of the new 'Govern' function in CSF 2.0, aiming to enhance overall risk management strategy and processes within organizations.

The CSF's adaptability to various sectors and the importance of making it accessible for small and medium-sized businesses.

The international government perspectives on leveraging the CSF for consistent cybersecurity measures, as discussed by representatives from Norway and the Czech Republic.

Industry perspectives on the CSF's role in cybersecurity governance and its practical applications within global companies like Schneider Electric.

The importance of storytelling in cybersecurity, using the CSF to communicate risks effectively to both technical and non-technical stakeholders.

The connection between the CSF and regulatory compliance, highlighting the framework's role in developing programs that meet regulatory expectations.

The final Q&A segment addressing practical questions on the CSF's application, such as managing third-party risks and leveraging the framework for data protection.

Transcripts

Browse More Related Video

Use the NIST Cybersecurity Framework for your Business!

Using the NIST AI Risk Management Framework // Applied AI Meetup October 2023

Cyber Supply Chain Risk Management: No Silver Bullet

NIST RMF FULLY EXPLAINED (IN PLAIN ENGLISH)

All The GRC Analyst Job Answers YOU Want

🔴 March 12's Top Cyber News NOW! - Ep 576

Related Tags

Cybersecurity Framework Global Use Risk Management NIST Collaboration International Stakeholders CSF 2.0 Cyber Risk Public-Private Partnership Security Governance Supply Chain Risk